# CVE-2026-111421

Airflow Task Execution API unsafe XCom deserialization allows attacker-controlled object instantiation.

- Page: https://www.vulneraibility.com/cve/CVE-2026-111421
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-09)
- Weakness: CWE-502
- Published: 2026-11-09

## Affected versions

- Apache Software Foundation Apache Airflow: affected >= 3.0.0 and < 3.4.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Authenticated DAG authors can craft XComs that trigger unsafe deserialization in the Task Execution API, enabling remote code execution or server compromise.

## Action

Immediate action required

## Recommendation

Upgrade to Apache Airflow 3.4.0+ and disable XCom deserialization until patched.

## References

- [patch] https://github.com/apache/airflow/pull/72718
- [patch] https://github.com/apache/airflow/pull/74829
- [other] https://www.cve.org/CVERecord?id=CVE-2026-59242
- [advisory] https://lists.apache.org/thread.html/pwdwx354tv0x3m8wzfhh59r6wyztj2lk

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.